First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2022-42735

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu.

ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own.

This issue affects Apache ShenYu: 2.5.0.

Upgrade to Apache ShenYu 2.5.1 or apply patch https://github.com/apache/shenyu/pull/3958 https://github.com/apache/shenyu/pull/3958 .

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache ShenYu	<= 2.5.0

References

Timeline

Published: Feb 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-42749.8A vulnerability, which was classified as critical, was found in House Rental System. Affected is an unknown function of the file /view-prope CVE-2022-427435.3deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the applicati CVE-2022-427449.8CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the ap CVE-2022-427457.5CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vul CVE-2022-427466.1CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This CVE-2022-427476.1CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is CVE-2022-427486.1CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. T CVE-2022-427496.1CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is po CVE-2022-42759.8A vulnerability has been found in House Rental System and classified as critical. Affected by this vulnerability is an unknown functionality CVE-2022-427508.8CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does no CVE-2022-427518.8CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffe CVE-2022-427536.1SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not

CVE-2022-42735: High severity, CVSS 8.8 | Vulnix